Some conventional secure computer systems protect a secret by exchanging a token for that secret. For example, suppose that a merchant accepts credit cards for payment. For such a merchant, locally storing customers' credit card numbers carries a risk of exposing those credit card numbers to an adversary. The merchant can replace each credit card number with a corresponding token, or a number meaningless to the adversary, generated by a secure tokenization server. The merchant would then recover a credit card number by sending the corresponding token back to the tokenization server.
The tokenization server generates tokens from secrets in such a way that an adversary would have very little chance in deducing the secret from the token. For example, the tokenization server can generate a token from a credit card number by applying a cryptographic function to the credit card number. Such a cryptographic function relies on a key which is used to recover the credit card number from the token. The tokenization server can also use a lookup table in a database to recover the credit card number from the token.